Sentinel update

Author: msftrobiro

articles/sap/workloads/rise-integration.md

@@ -196,7 +196,7 @@ SSO against Active Directory (AD) of your Windows domain for ECS/RISE managed SA
 
 The Microsoft Sentinel solution for SAP applications allows you to monitor, detect, and respond to suspicious activities and guard your critical data against sophisticated cyberattacks for SAP systems hosted on Azure, other clouds, or on-premises infrastructure. 
 
-The solution allows you to gain visibility to user activities on SAP RISE/ECS and the SAP business logic layers and leverage Sentinel’s built-in features.
+The solution allows you to gain visibility to user activities on SAP RISE/ECS and the SAP business logic layers and leverage Sentinel’s built-in content.
 -	Use a single console to monitor all your enterprise estate including SAP instances in SAP RISE/ECS on Azure and other clouds, SAP Azure native and on-premise estate
 -	Detect and automatically respond to threats: detect suspicious activity including privilege escalation, unauthorized changes, sensitive transactions, data exfiltration and more with out-of-the-box detection capabilities
 -	Correlate SAP activity with other signals: more accurately detect SAP threats by cross-correlating across endpoints, AAD data and more
@@ -213,12 +213,9 @@ To enable the solution, only an authorized RFC user is required and nothing need
 - Authentication methods supported in SAP RISE: SAP username and password or X509/SNC certificates
 - Only RFC based connections are possible currently with SAP RISE/ECS environments
 
-The following data sources may not available for a SAP RISE/ECS landscape:
-  - Client IP address information from SAP security audit log (*)
-  - DB table logs (preview), spool output log (*)
-  - SAPControl and JAVA application server logs
-  - Infrastructure and operating system logs (for example VMs running SAP). All aspects of the Azure infrastructure and operation system are monitored by SAP independently  
-*(*) Items noted with (*) require a change request with modifications and/or parameters for which SAP needs to be contacted.*
+Note for running Microsoft Sentinel in a SAP RISE/ECS environment:
+- The following log fields/source require an SAP transport change request to be deployed: Client IP address information from SAP security audit log, DB table logs (preview), spool output log. Sentinel's built-in content (detections, workbooks and playbooks) provides extensive coverage and correlation without those log sources.
+-	SAP infrastructure and operating system logs are not available to Sentinel in RISE, including VMs running SAP, SAPControl data sources, network resources placed within ECS. Aspects of the Azure infrastructure and operation system are monitored by SAP independently.
 
 For more information on Microsoft Sentinel and SAP, including a deployment guide, see [Sentinel product documentation](/azure/sentinel/sap/deployment-overview).